Managed file transfer on the same audited broker.
Move files between SFTP, FTP/FTPS, WebDAV and object storage through the broker that already holds the credentials. Ad-hoc copies, scheduled jobs and watched folders all run server-side, are governed by policy on the way through, and land on the same audit trail as every session.
the problem
File movement is where governed access quietly ends. An SFTP script on a jump box, a shared object-store key, a personal cloud-drive link — each carries a credential nobody rotates, and none of them leaves a record of what left the building.
What it does
- Every remote in one workspace
- Browse SFTP hosts alongside FTP, FTPS, WebDAV, S3-compatible buckets, Azure Blob containers and OpenStack Swift — each in its own tab, each opened with a credential from the vault rather than one on your laptop. Dropbox, Google Drive, OneDrive and Box connect over OAuth as further locations to browse.
- The server moves the bytes
- A remote-to-remote copy streams source to destination through the broker, so nothing round-trips via the browser and neither side's credential is ever handed to the client. An upload streams straight through to the remote instead of being buffered in server memory — unless content inspection has to see it first. A DLP redact rule, a secrets-severity floor, or a malware, CDR, reputation or detonation engine your operator has configured each holds the file in memory up to a configured inspection limit, and anything larger is refused rather than let past unexamined.
- Unattended movement
- Turn a move into a durable job that retries with exponential backoff and re-hashes the destination to confirm what arrived. Fan one source out to several destinations, archive or delete the source only once every delivery succeeded, and run the whole thing on an interval or at a fixed time each day.
- Watched folders and reusable workflows
- Point a watcher at a folder and new files are delivered on their own, filtered by name pattern, size or age, and held back until the file has stopped growing. Save a routine as a versioned workflow template and instantiate it instead of rebuilding it.
- Policy on the path, not after the fact
- A per-organisation DLP policy maps filename globs to allow, redact or block and can refuse anything above a secrets-severity floor. Bandwidth policy caps per-transfer throughput, narrows it inside business-hours windows and limits how many transfers run at once. Where an operator has configured a scanner, uploads are scanned before they are written and a blocked file is refused and recorded in a quarantine ledger that holds metadata only.
- Send and receive outside the org
- Share a file as a time-limited link, capped by how many times it can be opened, that streams through the broker, so the recipient never touches the underlying connection or its credential — optionally bound to a one-time code sent to that recipient. Or publish a drop zone that lets someone upload into exactly one folder without an account.
- AS2 and EDI for trading partners
- Exchange AS2 messages with MDN acknowledgements against a managed partner list, and detect, parse, validate and acknowledge X12 and EDIFACT documents. AS2 is an entitlement that is off by default on every plan and is turned on deliberately.
build-01 · /srv/releases
Transfer to…release-2.4.1.tar.gz
184 MB · sha256 verified
invoices-2026-08.zip
12 MB · DLP: allowed
customer-export.csv
3.1 MB · DLP: redacted
nightly/
folder · watched
- SFTP, FTP, FTPS, WebDAV, S3, Azure Blob and Swift
- Server-to-server copies — bytes never touch the browser
- Scheduled jobs, watched folders and reusable workflows
- DLP, malware scanning and bandwidth policy on the path
how we back it up
No hand-waving on security
faq --list
Transfer — questions
Which protocols and storage can it reach?
SFTP over your existing SSH connections, plus FTP, FTPS, WebDAV, S3-compatible object stores, Azure Blob Storage and OpenStack Swift. Dropbox, Google Drive, OneDrive and Box connect over OAuth once an operator has configured the app credentials.
Can I resume an interrupted upload?
No. A browser upload streams straight through to the remote, and if the connection drops you start it again — we would rather say so than imply a resume that is not there. For anything large or unattended, create a transfer job instead: it runs server-side, survives you closing the tab, retries on its own and verifies the destination hash.
How do I send a file to someone who has no account?
Create a share link. It is time-limited, capped by how many times it can be opened, streamed through the broker so the connection credential is never exposed, and can require a one-time code sent to the recipient. To receive instead, publish a file request — a drop zone that writes into one folder and nowhere else.
What stops someone moving data they should not?
A per-organisation DLP policy is evaluated on upload, transfer and share, and can allow, redact or block by filename pattern or by the severity of secrets found in the content. A network access policy can also restrict your organisation's own file and cloud-storage routes by source IP address and country before any of them run — a network control, not an identity check; it says where a request may come from, never who is making it. Share links and drop zones deliberately reach people outside the organisation, so each is governed instead by an expiry and a cap on how many times it can be used — a share link can additionally require a one-time code sent to the named recipient — and both run through the same DLP policy on the way. Every action is written to the audit trail.
Does it handle B2B file exchange?
Yes. AS2 messaging with MDN acknowledgements and managed trading partners, and an EDI surface that detects, parses and validates X12 and EDIFACT documents and generates 997 and CONTRL acknowledgements. AS2 is off by default on every plan and is enabled deliberately.